     (.setURI res (URI. url))
     res))
 
-(def insecure-socket-factory
+(def ^{:private true} insecure-socket-factory
   (doto (SSLSocketFactory. (reify TrustStrategy
                              (isTrusted [_ _ _] true)))
-    ;; TODO: should this be controlled by a separate flag?
     (.setHostnameVerifier SSLSocketFactory/ALLOW_ALL_HOSTNAME_VERIFIER)))
 
-(def insecure-connection-manager
-  (ThreadSafeClientConnManager.
-   (doto (SchemeRegistry.)
-     (.register (Scheme. "https" insecure-socket-factory 443)))))
+(def ^{:private true} insecure-scheme-registry
+  (doto (SchemeRegistry.)
+    (.register (Scheme. "https" insecure-socket-factory 443))))
 
-(def connection-manager (ThreadSafeClientConnManager.))
+;; TODO: allow re-use of ThreadSafeClientConnManager
+(defn- connection-manager [& [insecure?]]
+  (if insecure?
+    (SingleClientConnManager. insecure-scheme-registry)
+    (SingleClientConnManager.)))
 
 (defn request
   "Executes the HTTP request corresponding to the given Ring request map and

  [{:keys [request-method scheme server-name server-port uri query-string
           headers content-type character-encoding body socket-timeout
           conn-timeout debug insecure?] :as req}]
  (let [http-client (if insecure?
                      (DefaultHttpClient. insecure-connection-manager)
                      (DefaultHttpClient.))]
    (try
      (doto http-client
        (set-client-param ClientPNames/COOKIE_POLICY

                                           HttpEntityEnclosingRequestBase)
           (org.apache.http.client.params CookiePolicy ClientPNames)
           (org.apache.http.conn.scheme SchemeRegistry Scheme)
           (org.apache.http.impl.conn SingleClientConnManager)
           (org.apache.http.conn.ssl SSLSocketFactory TrustStrategy)
           (org.apache.http.impl.client DefaultHttpClient)
           (org.apache.http.conn.params ConnRoutePNames)))
